b2KIT

File Type Identifier

Identify file types by magic bytes and file signatures regardless of file extension, detecting over 100 formats.

Tested tool guide Tested browser tools Checked August 16, 2026

What File Type Identifier does, with a checked example

A file's name is a promise, not a property: anyone can call a text file notes.pdf. This tool ignores the name and inspects the bytes the file actually begins with, matching them against a table of magic numbers and signatures covering over 100 formats, then reports what the data itself declares. Drop a file on the page or paste its leading bytes as hex. The most surprising result: a .docx, .xlsx, .epub or .jar file comes back as a ZIP archive, because that is what it is. The extension records the application format; the bytes record the container. Inspection happens locally in the browser, so nothing is uploaded.

Worked example

A concrete input and expected output from the current implementation.

Input

89 50 4E 47 0D 0A 1A 0A

Expected output

PNG image (Portable Network Graphics)

These eight bytes are the signature that RFC 2083 requires at the start of every PNG file: a high-bit byte, the letters PNG, then carriage return, line feed, Ctrl-Z, line feed. The odd pattern exists so files mangled by text-mode transfers never match it by accident. Every real PNG file, under any extension, begins with exactly these bytes.

How the result is produced

1

Signature table matching

Every known format contributes at least one signature: a sequence of bytes that must appear at the start of the file, sometimes with wildcard positions or at a fixed offset. The tool reads the file's opening bytes, compares them against the signature table, and reports the format whose signature matches. The extension is ignored entirely, so a mislabeled file cannot influence the result.

2

Text headers versus raw bytes

Signatures come in two flavors. Many formats announce themselves as readable ASCII at the start - %PDF for PDF, GIF89a for GIF, PK for ZIP - while others begin with raw bytes with no printable meaning, like 0x89 in PNG or 0xFF 0xD8 in JPEG. The comparison runs on raw hex values, so one mechanism covers both: an 'ID3' tag identifies MP3 audio, and bytes 0x1F 0x8B identify gzip compression.

Good uses

  • A download or email attachment arrived with no extension, or with a meaningless one like .tmp or .bin, and you need to know what you are dealing with before choosing a program to open it.
  • A file whose extension promises one format - .jpg, .doc, .mp3 - will not open in the program that should own it; check whether the bytes contradict the name before renaming files or reinstalling software.
  • Sorting an unlabeled batch - exports from a web cache, files recovered from a disk image, legacy files with uniform names - where you want files grouped by their real format rather than by guesswork.

Limits and checks

  • ZIP-family ambiguity. .docx, .xlsx, .pptx, .epub, .odt and .jar all begin with the same 'PK' bytes because they are all ZIP containers. The first bytes alone cannot tell them apart, so a ZIP verdict does not mean the identifier is wrong or the file is corrupt; the extension is the only cue to which application format the container holds.
  • A matching signature is not proof of validity or safety. Anyone can prepend a few bytes so a file begins like a PDF or a PNG, and a file truncated to just its header still matches its signature. Use the result to learn the format, not to certify it; for security questions use a scanner.
  • Plain text has no signature to match. JSON, CSV, source code and HTML can begin with almost anything, including whitespace or a byte-order mark, so text verdicts are typically inferred rather than certain, and formats missing from the table may be reported as unknown or under a closely related name.

Common questions

Why does my .docx file come back as a ZIP archive?

Because that is what it is. Office files in the Open XML family are ZIP containers holding XML parts and media, and the ZIP signature 'PK' is literally the first thing in the file. The extension tells you which application format the container holds; the leading bytes can only tell you it is a ZIP. To get the application verdict, open the file in its own program, which checks the inside.

Does the tool upload my file to analyze it?

No. The identifier runs entirely in your browser: the file is read on your machine, its opening bytes are compared against the signature table locally, and the file never leaves your device - it works offline for the same reason. That design also means the tool only ever sees the header, never the body, contents or any other part of the file.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools